Quantum Secret Sharing Schemes and Reversibility of Quantum Operations 
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I. INTRODUCTION 

Quantum secret sharing ( QSS) schemes were studied 
by several authors [1-5] as quantum counterparts of clas- 
sical secret sharing (SS) schemes [6, 7]. QSS schemes are 
methods to encrypt an arbitrary quantum state or clas- 
sical message into a multipartite entangled state among 
several quantum systems, namely shares, in the following 
way: each of shares has no information about the original 
state or message while it can be reproduced by collect- 
ing several shares. QSS schemes can be classified into 
two categories based on what is encrypted, i.e., quantum 
states [3-5] or classical messages [1, 2]. In this paper, we 
treat only the QSS schemes encrypting quantum states, 
which we call just QSS schemes for simplicity. 

In the literature on QSS schemes in this sense, the 
(k , n) -threshold QSS scheme was proposed by Cleve et 
al. [3]. In the (k, n)-threshold QSS scheme, an arbitrary 
quantum state is encoded into n shares so that any k out 
of n shares can reproduce the original state while any k— 1 
or less shares have no information about it. Recently, ex- 
perimental demonstrations [8, 9] of the threshold scheme 
were reported. After the work of Cleve et al. , Gottes- 
man [4] demonstrated that any general access structure 
consistent with the monotonicity [10] and the no cloning 
theorem [11-15] can be realized by a QSS scheme. The 
same result was shown by Smith [5] independently by 
using monotone span programs. Gottesman [4] also an- 
alyzed the coding efficiency of QSS schemes and showed 
that the dimension of each share must be the same or 
larger than that of the original system. 
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In this paper, we revisit the coding efficiency of QSS 
schemes in an information theoretical manner. First, we 
establish a relation between the reversibility of quantum 
operations and the Holevo information [16] in a general 
setting rather than QSS schemes. This relation is a nat- 
ural extension of the idea in the classical information 
theory that the sufficient statistic is characterized by the 
preservation of the mutual information [17]. In classical 
statistical inferences, the sufficient statistic has several 
equivalent characterizations [18]: the existence of reverse 
channels, the preservation of information quantities such 
as the relative entropy, and the factorization theorem. 
On the other hand, the reversibility of quantum opera- 
tions was studied by several authors [19-21] related to 
the quantum error correcting code [22, 23], while it was 
also studied in terms of sufficiency in the field of the 
operator algebra [24-30] (see also Refs. [31, 32]). 

Recently, Petz and his colleagues [33, 34] have estab- 
lished a theory of sufficiency in the quantum setting, that 
is characterized by the reversibility of quantum opera- 
tions (or coarse-grainings), the preservation of informa- 
tion quantities, and the quantum version [35, 36] of the 
factorization theorem. Our characterization of the re- 
versibility falls into a natural variant of theirs. However, 
we rather use the term reversibility in this paper for the 
reasons that the characterization is closely related to the 
literature in the quantum error correcting code and that 
the notion of sufficiency is not yet so clear in quantum 
statistical inferences such as the quantum estimation the- 
ory [37-39] and quantum hypothesis testing [37, 39-42]. 

Second, returning to QSS schemes, we utilize the char- 
acterization of the reversibility to evaluate a kind of infor- 
mation that each share has about the original quantum 
state, and then the evaluation leads to the lower bound 
on the dimension of each share given by Gottesman [4]. 
It should be noted [55] that a similar result on the di- 
mension of each share has been given in Ref. [43] by a 
different method using the reference system relevant to 
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the coherent information [21]. 

As mentioned above, it is impossible to reduce the di- 
mension of each share than that of the original system 
in QSS schemes which have perfect security conditions. 
Here, the perfect security conditions mean that any set 
of shares can either reproduce the original state or obtain 
no information about it, and such schemes are called per- 
fect QSS schemes. On the other hand, in classical ramp 
SS schemes [44, 45], the size of each share can be de- 
creased by the sacrifice of security conditions admitting 
the intermediate property for some sets of shares. Follow- 
ing these classical counterparts, we propose a ramp QSS 
scheme and analyze the coding efficiency of it. Then, it 
is shown that the dimension of each share can be reduced 
than that of the original system by the sacrifice of secu- 
rity conditions like the classical ramp schemes. Finally, 
we also demonstrate an optimal construction of the ramp 
QSS scheme. 

II. DEFINITIONS 

Let H, J ', K, be finite dimensional Hilbert spaces, and 
let £(H) and S(H) be the totalities of linear opera- 
tors and density operators on a Hilbert space H, respec- 
tively. We will treat QSS schemes encrypting a quantum 
state on H into a composite system of Hilbert spaces 

dcf 

Hi,... ,H n , each of which is called a share. Let N — 

{1, . . . , n} be the entire set of shares and Hn — ®i e jv ^* 
be the corresponding Hilbert space. For a subset X C N 

of shares, let Hx = f ® as weu - The encoding op- 

eration of a QSS scheme is described by a quantum opera- 
tion Wjv : S(H) — > S(Hn), which is a completely positive 
and trace preserving map. For a subset X C N, the com- 
position map of the encoder Wjv and the partial trace of 

the complement N\X is denoted by Wx = ^n\x 'Wn- 
Now we will define the notion of the reversibility for 
general quantum operations. A quantum operation £ : 
S(J) — > S(JC) is called reversible with respect to (w.r.t.) 
a subset S C S{Sf) of density operators if there exists 
a quantum operation 1Z : S(JC) — > S( J) such that \/p e 
S, 1Z ■ £{p) = p. A quantum operation £ : S{J) — > 
S(JC) is called vanishing w.r.t. S C S(J) if there exists a 
density operator p € S(K) such that Vp G S, £(p) = po- 

Remark 1. It should be noted here that a quantum op- 
eration is reversible (resp. vanishing) w.r.t. S C S( J) iff 
it is reversible (resp. vanishing) w.r.t. the extreme points 
of the convex hull of S . Therefore, letting S\(^f) be the 
totality of pure states on J , a quantum operation is re- 
versible (resp. vanishing) w.r.t. S( J) iff it is reversible 
(resp. vanishing) w.r.t. S\{J). 

A QSS scheme is defined by a quantum operation 
Wn ■ S(H) — > S(Hn) which is reversible w.r.t. S(H). 
For a QSS scheme Wn, a set X C N is called quali- 
fied (resp. forbidden) if Wx is reversible (resp. vanish- 
ing) w.r.t. S(H), and, in addition, a set X C N is called 



intermediate if Wx is neither reversible nor vanishing 
w.r.t. S{H). A QSS scheme Wn is called a perfect scheme 
if any set X C TV is either qualified or forbidden. Other- 
wise, Wjv is called a ramp scheme. Although the terms 
"authorized" and "unauthorized" are used in the pre- 
vious works [3, 4] on perfect QSS schemes, we use the 
terms "qualified" and "forbidden" in this paper because 
we must divide "unauthorized" sets between "intermedi- 
ate" sets and "forbidden" sets in ramp QSS schemes. 

III. ACCESS STRUCTURE 

The access structure of a QSS scheme is the list of 
forbidden, intermediate, and qualified sets. In classical 
ramp secret sharing (SS) schemes [44, 45], intermediate 
sets are classified further into multilevel categories based 
on the conditional entropy. In ramp QSS schemes, how- 
ever, we do not classify the intermediate sets for sim- 
plicity in this paper. Formally, the access structure of 
the set N is defined by a map / : 2^ — > {0, 1, 2}, where 

0, 1, and 2 indicate forbidden, intermediate, and quali- 
fied sets, respectively. For a QSS scheme Wjv, the ac- 
cess structure of N is determined naturally, and hence, 
is called the access structure of Wn- It is clear that 
the access structure of Wjv satisfies the monotonicity, 

1. e., X C Y => f(X) < f(Y). In addition to this rela- 
tion, the restriction due to the no cloning theorem [11- 
15] (see also Proposition 3 in the appendix) is imposed 
on QSS schemes, that is, the complement of a qualified 
set is necessarily forbidden. Conversely, it was shown in 
Refs. [4, 5] that any perfect access structure, consistent 
with the monotonicity and the no cloning theorem, can 
be realized by a perfect QSS scheme. 

A quantum operation £ is called a pure state channel if 
£{p) is a pure state for any pure state p. A QSS scheme 
W/v is called a pure state scheme if it is a pure state 
channel. Otherwise, it is called a mixed state scheme. 
Gottesman [4] showed that any perfect QSS scheme is 
regarded as a subsystem of a pure state QSS scheme. 
The following lemma is a slight extension of his result 
including ramp QSS schemes. 

Lemma 1. Any mixed state QSS scheme Wn is realized 
by discarding one share from a pure state QSS scheme 
Wjv ■ Moreover, the access structure of Wjv is deter- 
mined uniquely by that of Wn ■ 

Proof. From the Stinespring dilation theorem [46], there 
exists a Hilbert space Hz and an isomctry V : H i— > 
Hn ® Hz such that 

W N (p)=Tr z [VpV*]. (1) 

Let N' = JVU Z, then Wjv is realized from the pure state 
QSS scheme Wjv(p) = VpV* by discarding one share 
Z. We note that the access structure of Wjv for a set 
X C N not including Z is the same as that of Wjv ■ Hence 
we will consider the access structure of Wjv for X C N' 
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which includes Z . It follows from Proposition 3 in the 
appendix that X is qualified iff N'\X is forbidden, and 
equivalently that X is forbidden iff N'\X is qualified. 
Furthermore, we can also see that X is intermediate iff 
N'\X is intermediate. Therefore, the access structure 
f(X) is determined uniquely by the complement N'\X C 
N. ' □ 



IV. REVERSIBILITY AND HOLEVO 
INFORMATION 

In this section, turning to a general setting, we will 
demonstrate that the Holevo information [16] is closely 
related to the reversibility of quantum operations. 

For p,a£ S(J), let 



£(p||a) d ^ f Tr[p(logp-log<7)] 



(2) 



be the quantum relative entropy. Then, for any quantum 
operation £ : S{J) — > S{JC), it yields the monotonicity 
[47-49], i.e., 



D{p\\a)>D{£{p)\\£{a)), 



(3) 



and the equality holds iff £ is reversible w.r.t. {p, a} [29] 
(see also Refs. [31, 32]). Furthermore, in the case of 
equality, there is a canonical reverse operation depending 
only on a, which is given by 

TZ a (T) = a?£*(£ (<7)-*t£(<7)-*)<7* ( 4 ) 
Here £* : £(fC) — > C{J) is the dual of £ satisfying 

V P e S{J), vr e C{JC), Tt[£{ p )y] = Tt[ p £*{y)} . 

The above fact is summarized as the following proposi- 
tion. 

Proposition 1 (Petz [29], see also Refs. [31, 32]). 

Given a quantum operation £ : S( J) — > S{JC) and p,a G 
S( J^), let lZ a be the quantum operation defined by (4). 
Then the following three conditions are equivalent. 

(a) D(p\\a) = D(£(p)\\£(a)) 

(b) TZ a ■ £(p) = p 

(c) £ is reversible w.r.t. {p,a}. 

This fact can be easily extended to a general relation 
between the Holevo information and the reversibility of a 
quantum operation w.r.t. a subset S C S{J). Let V(S) 
be the set of probability measures on S C S{J), and let 



E 



(5) 



be the expectation by a probability measure p G ~P{S). 
Given an ensemble p G V{S) and a quantum operation 
£, the Holevo information is defined by 



/( M ;£) a =%[£(£(p)l|£K))] 

= H(£(a^))-E fl [H(£(p))], 



where = f E^p] and H(p) = f — Tr[/3logp] is the von 
Neumann entropy. Moreover, let P+{S) be the set of 
probability measures on S C iS(j7") which are positive 
almost everywhere on S. More specifically, 

V+(S) = {p G | VO C 0(5), /x(O) > 0} , (7) 

where 0(S) is the totality of open sets on S, and is de- 
fined in terms of the relative topology induced by the 
inclusion S C S{J). Then we have the following theo- 
rem. 

Theorem 1. Let I : S{J) — > 5(^7") &e t/ie identity map. 
Given a quantum operation £ : S{ J) — > <S(/C) anii 5 C 
iS(j7), f/ie following three conditions are equivalent. 

(a) £ is reversible (resp. vanishing) w.r.t. S. 

(b) Vp G 7? + (5), = I{p\I) {resp. = 0). 

^cj 3 M G = I{p\I) {resp. = 0). 

Proof, (a) =>(b): From the definition of the reversibility, 
there exists a quantum operation 1Z such that Vp G S, 1Z- 
£{p) = p. Taking the expectation of p by an arbitrary 
p G V+(S), we have TZ-£{a^) = o^. Then it follows from 
"(c) =>(a)" of Proposition 1 that 



Vpe5, £>(p||^) = I>(5(p)||5(^)) 



(8) 



Taking the expectation of the above equality by p leads 
to (b). 

(b) =>(c): Obvious. 

(c) =>(a): First, note that 

J( W 2) - - E M [D(p||tr„) - D{£{p)\\£{a^)] 

> 0, (9) 

since the monotonicity of the quantum relative entropy 
leads to 



D{p\\a^-D{£{p)\\£{a^))>0 



(10) 



(6) 



for each term in the expectation of (9). Therefore we 
can see from the definition of V+{S), along with the 
continuity of £ and the quantum relative entropy, that 
(8) is a necessary condition for I{p;X) — I(p;£) = 0. 
Using "(a) =>(b)" of Proposition 1, we have that Vp G 
S, IZa^ ■ £{p) = p, which implies (a). 

As for the vanishing property, we can show the as- 
sertion in the same way as the reversibility by using 
D{p\ \a) > and D{p\ |cr) = ^ p = a. □ 



V. CODING EFFICIENCY OF QSS SCHEMES 

Let Si{7i) be the totality of pure states on 7i, and 
note that a quantum operation is reversible (resp. van- 
ishing) w.r.t. S(H) iff it is reversible (resp. vanishing) 
w.r.t. Si(H). Therefore it suffices to treat the reversibil- 
ity of a QSS scheme Wm w.r.t. S\{TL). For a pure state 
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ensemble p € V+(S\('H)), the Holevo information is 
given by I(p;2) = H(a p ), since H(p) = for any pure 
state p E Si(H), and hence, the following theorem im- 
mediately follows from Theorem 1. 

Theorem 2. For any QSS scheme Wn, the following 
three conditions are equivalent. 

(a) X is qualified (resp. forbidden). 

(b) Vp € J(/i; WOO - H(a p ) ( res P- = 0). 

(c) Bp € /(/i; Wx) - 77(<7 M ) (resp. = 0). 

Remark 2. Theorem 2 can be regarded as a variant of 
the perfect error correcting condition [21] without using 
reference systems, while Theorem 1 is an extension of 
these conditions to the reversibility condition w.r.t. gen- 
eral subsets of S(H). 

Remark 3. As is clear by definition, it is also interest- 
ing to observe from Theorem 2 that the access structure 
of QSS schemes does not depend on p in V+(Si(H)). We 
note that this fact holds in classical perfect SS schemes. 
Actually, corresponding statements are given by a differ- 
ent approach in Ref. [50]. 

Now we consider the coding efficiency of QSS schemes. 
A set X C TV is called significant if there exists a forbid- 
den set Y C N such that X U Y is qualified. 

Theorem 3. For any significant set X C N of any QSS 

scheme Wn, it holds that 

Vp e V+iStiH)), %) < H(W x (o,)). (11) 

Proof. From Lemma 1, Wn is supposed to be a pure 
state scheme without loss of generality. Moreover, for 
any significant set X C N we can choose a forbidden sets 
Y C N such that XUY is qualified and XDY = 0. Then 
it holds that I(p; W X y) = H(a p ) and I(p; W Y ) = for 
any p g V+(Si(H)) from Theorem 2, and hence, we have 

77^) = I(p;W XY ) - I(n;W Y ) 

= H(Wxy(o-^)) - E p [H(W X y(p))] 

-H(Wy(^))+^[H(W y (p))] 
<H(W x (a^)~E^[H p (Wx\W Y )], (12) 

where the last inequality follows from the subadditivity 
of the von Neumann entropy and we have written the 
conditional entropy as 

H P (W X \W Y ) =H(W X y(p)) - H(W Y (p)). (13) 

Now let Z = N\(X U Y) and note that W N = W X yz is 
a pure state channel. Then it follows from Proposition 3 
in the appendix that qualified X (J Y implies forbidden 
Z and forbidden Y implies qualified X U Z. Hence, since 
Z has the same property as Y, Z also satisfies the same 
inequality as (12), i.e., 

H(a p ) < H(Wx(<r li ))-'E li [H p {Wx\Wz)]. (14) 



Since Wxyz(p) is a pure state, we have H(Wxy(p)) — 
H(W z (pj) and H{W X z{p)) = H{W Y {p))- Conse- 
quently, it follows from (12) and (14) that 

H(a p )<H(W x (^)) 

- ^E p [H p (W x \W Y ) + H p (Wx\W z )] 

= H{Wx{(T»)), (15) 

which has been asserted. □ 

Corollary 1 (Gottesman [4]). For any significant 
share i e N of any QSS scheme Wn, we have 

dimW < AunU t . (16) 

Proof. Let fi be the uniform distribution on Si(H) in 
Theorem 3, namely the invariant measure with respect to 
the special unitary group. Then we have a p = I / divaTL 
and the dimension of each share is bounded below as 

logdimW = 77(<7 M ) < H(W t (a p )) < logdimH,. (17) 

□ 

Remark 4. The arguments and the theorems so far are 
valid even in the classical cases. That is verified by re- 
placing the corresponding notions with the classical ones. 
For example, quantum operations, the Holevo informa- 
tion, and pure states are replaced with channels, the mu- 
tual information, and delta distributions, respectively. In 
this case, it should be noted that the proof of Theorem 3 
is already finished in (12), since the conditional entropy 
is nonnegative in the classical cases. 

VI. RAMP QSS SCHEMES 

From Corollary 1, it is impossible to reduce the di- 
mension of each share than that of the original system 
in perfect QSS schemes, since any share except useless 
ones should be significant in perfect QSS schemes. On 
the other hand, in classical ramp SS schemes such as 
(k, L, n)-threshold ramp SS schemes [44, 45], the size of 
each share can be decreased by taking into account the 
trade-off between the security condition and the coding 
efficiency. We utilize this idea in the quantum setting 
to propose (k, L,n) -threshold ramp QSS schemes in the 
following sense. 

Definition 1. A QSS scheme Wn is called a (k,L,n)- 
threshold ramp QSS scheme if the following conditions 
are fulfilled. 

(a) X C N is forbidden iff \X\ < k - L. 

(b) X CN is qualified iff\X\> k. 
Note that the above conditions imply 

(c) X C N is intermediate iff k - L < \X\ < k, 
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and the (k, L, n)-threshold ramp QSS scheme reduces to 
the (k, n)-threshold QSS scheme [3] if L — 1. 

Cleve et al. [3] showed that the condition n < 2k — 1 
must be satisfied for the (k, n)-threshold QSS scheme to 
exist. As an extension of this condition, we have the 
following lemma. 

Lemma 2. For a (k, L,n) -threshold ramp QSS scheme, 
it holds that n < 2k — L. Especially, we have n = 2k — L 
if it is a pure state QSS scheme. 

Proof. From Definition 1, X is a qualified set if \X\ = k. 
In this case, it follows from Proposition 3 in the appendix 
that the complement N\X is forbidden, which implies 
|7V\X| = n — k < k — L. In the case of a pure state QSS 
scheme, we can also show that n > 2k — L in the same 
way. □ 

Similarly to Theorem 3 and Corollary 1, we can eval- 
uate the coding efficiency of the ramp scheme as follows. 

Theorem 4. For (k, L, n)-threshold ramp QSS schemes, 
it holds that 

e jH(a^) < I ]T H(W t (a^)). (18) 



Proof. For any set X C N with the cardinality \X\ = L, 
there exists ycJV such that XnY = and \Y\ = k-L. 
Then X U Y is qualified while Y is forbidden. Therefore 
it follows from Theorem 3 that 

%) < H(W x {a^)) < £ H(Wi(o-„)), (19) 

iex 

where we used the subadditivity of the von Neumann en- 
tropy. Finally we can show (18) by taking the arithmetic 
mean of (19) for all X C N satisfying \X\ = L. □ 

Corollary 2. For (k, L, n)-threshold ramp QSS schemes, 
we have 



— dim H < — dim Hi . 
L n f—" 1 . 



(20) 



The above corollary implies that the dimension of each 
share can be decreased by the factor 1/L in the average 
sense than that of the original system. 



VII. CONSTRUCTION OF RAMP SCHEMES 

In this section, we will show a method to realize 
(k, L, n)-threshold ramp QSS schemes which has the op- 
timal coding efficiency in the sense of Corollary 2. The 
encoding and reverse operations used here are regarded 
as extensions of Ref. [3] to the ramp QSS scheme. 

Let F be a finite field with q = f |F| > n, and let 
Jj (j = 1, . . . , L) and Hi (i G N — {1, . . . , n}) be isomor- 
phic Hilbert spaces with dimension dim Jj = dim Hi = q 



and an orthonormal basis {|s)} sG f indexed by F. We 
will construct a pure state QSS scheme Wn which maps 

a quantum state on H == ® j = i Jj into the composite 

def 

system of shares Hn = ®i^N Note that n — 2k — L 
holds from Lemma 2. Since the pure state QSS scheme 
Wn is represented by an isometry V : H — > Hn as 

W N {p) = VpV*, (21) 

it suffices to specify the images V |s L ) of the basis 

\s L ) = | Sl ) ® • • • ® \ SL ) , s L = (si, . . . , s L ) e F L 

on H. For this purpose, we utilize the polynomial of de- 
gree k — 1 on F specified by coefficients c = (ci, . . . , Ck) € 
F fc , i.e., 



Pc(x) = 



(22) 



i=l 



By providing publicly revealed constants x\, . . . , x n € F 
which are different from each other, define the isometry 
V by 

V\s L )^^= J2 \Pc{x,),..., Pc {x n )), (23) 
where 

D{s L ) A ^ {(ci, . . . ,c fc ) G F fc | c, = s 4 (i = 1, . . . ,L) } , 

and C is a normalization constant to be specified later. 
Now, in order to verify that V is actually an isome- 
try, let us introduce the following notations for X = 
{ii, ■ ■ ■ ,i m } C N 



M%(X) = f 



( x l 

X ii 



(a < b), 



■ iVc{x im )). 



(24) 



(25) 



Then we have p c (X) = (ci, . . . , Ck)M^_ 1 (X), and the 
following lemma is useful for later discussions. 

Lemma 3. For each s L G F L , f/ie map c G D(s L ) i— » 
p c (X) is injective if\X\ >k — L. Especially, it is one-to- 
one if \X\ = k — L. Similarly, the map c e F* ^ p c (I) 
is injective if \X\ > k, and it is one-to-one if \X\ = k. 



Proof. The injective property is verified by the following 
relation 



Pc(X) = (si, . . .,S L ,C L+ i, . .. ,Cfe) 



M L-l( X )\ 



(26) 



since M^_ 1 (X) has the full column rank if \X\ > k—L. In 
addition, it is one-to-one if \X\ — k — L, since |D(s L )| = 
|IF fe ^ | . In the same way, we can show the remaining part 
of the lemma. □ 
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From the above lemma, we can see that \p c (N)} (c G 
F fe ) are orthogonal to each other, and hence, V |s L ) (s L G 
F L ) are also orthogonal to each other, which ensures that 
V is isometric. At the same time, the normalizing con- 
stant is determined as C = q k ~ L . 

Next, we will show that thus constructed QSS scheme 
Wn is actually a (k, L, n)-threshold ramp scheme. 

a. Qualified sets In order to verify that X is quali- 
fied for \X\ > k, it suffices to show that X = {1, . . . , k} 
is qualified, because of the symmetrical way to construct 
Wn and the monotonicity of the access structure. The 
following local operations on X realize the reverse oper- 
ation of Wx ■ 

1. Perform the unitary transformation on X corre- 
sponding to p c (X)M®_ 1 (X)~ 1 , which turns the 
summation in (23) into 

E l Cl ' ' ' ' > c k,Pc(x k +i), ■ ■ ■ ,Pc{x n )) ■ (27) 
ceD(s L ) 

2. Noting that n — k = k — L, perform the unitary 
transformation on X corresponding to the linear 
transformation: 

(ci,...,c fe ) ^ M L_ i{N \ x) j- (28) 

Then (27) yields 

|* L ) E \Pc(N\X))\p c (N\X)), (29) 
ceD(s L ) 

which can be represented by Lemma 3 as 

h L ) E \y k - L )\y k ~ L ) ■ (so) 

Thus, we have recovered \s L ) on {1, ... , L} from V \s L ) 
by the local operations on X. 

b. Forbidden sets When \X\ < k~ L, N\X is qual- 
ified since |iV\X| > k. Therefore it follows from Propo- 
sition 3 in the appendix that X is forbidden. 

c. Intermediate sets In the case \X\ ~k — l(0<l< 
L), we show that X is intermediate. For this purpose, 
it is sufficient to show that for X = {1, . . . , k — I}, Wx 
is neither reversible nor vanishing w.r.t. a subset S = 
{\s L )(s L \} sL ¥L included by S{H). Taking Theorem 2 
into account, let us calculate the Holevo information 

I(H;W X ) = HiWxiaJ) - E„ [H (W x (\s l )(s l \))] 

and H(a fl ) for the uniform distribution fi on S. Then 
the von Neumann entropy is easily calculated as H(a^) — 
L \ogq since ct m = I / q L . On the other hand, from Lemma 
3 and 

\N\X\ = n — (k — I) = (2k — L) — (k — I) > k — L, 



we have 

W x {\s L )(s L \) 

= £ E (p d (N\X),p c (N\X))\p c (X))( Pd (X)\ 

c,deD(s L ) 

= 7^ E \Pc(X))(p c (X)\. (31) 

ceD(s L ) 

Lemma 3 with \X\ = k — I > k — L also enables us to 
see that \p c (X)) in the summation in (31) are orthogonal 
to each other, and hence, we have H (Wx (| sL )( si |)) = 
(k-L) logq for all s L G F L . Next, letting Y = {!,..., k], 
we have 

4e wa\* l ){s l \) 

s L e¥ L 

= 4c ^ ^ (p d (N\Y),p c (N\Y)) \ Pc (Y))( Pd (Y)\ 

s L ev L c,deD(s L ) 

= 3 E E \Pc(Y))(p c (Y)\ 

s L ev L ceD(s L ) 

= I/q\ (32) 

where the third and last equalities follow from Lemma 
3. Then we have W*^) = I/q k ~ l and H(W x {a^)) = 
(k — I) logq. Consequently, it holds that 

< 7( M ; W x ) = {L — l) logq <Llogq = H{<rJ. (33) 

Therefore it follows from Theorem 2 that Wx is neither 
reversible nor vanishing w.r.t. S. 

At last, it is confirmed that Wn actually realizes the 
(fc, L, n)-thrcshold ramp scheme. It is clear from the con- 
struction of Wn that the coding efficiency of Wn is op- 
timal in the sense of Corollary 2. 



VIII. CONCLUDING REMARKS 

In this paper, we have revisited the lower bound on the 
dimension of each share in QSS schemes given by Gottes- 
man [4], and gave a rigorous proof for the lower bound 
(Theorem 3 and Corollary 1). The key idea of the proof 
was as follows. First, we have established a fundamen- 
tal relation between the reversibility of quantum opera- 
tions and the Holevo information (Theorem 1). Then, we 
have treated the qualified or forbidden condition as the 
reversible or vanishing condition for the corresponding 
quantum operation. These steps gave us clear insights 
into QSS schemes and even into classical SS schemes (sec 
Remark 4). For example, we can easily see from these 
pictures that the qualified or forbidden condition is inde- 
pendent of the probability of the source ensemble in both 
classical and quantum cases (Remark 3). 
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We have also proposed a ramp QSS scheme called the 
(k, L, n)-threshold QSS ramp scheme so that the dimen- 
sion of each share could be decreased than that of the 
original system by the sacrifice of security conditions. 
Finally we have analyzed the coding efficiency of the 
(k, L, n)-thrcshold ramp scheme and shown an optimal 
construction to attain the lower bound on the efficiency. 

One may wonder that a forbidden party with the for- 
bidden set of shares could disturb the protocol in QSS 
schemes by using the property of the entanglement. In 
other words, what happens if the forbidden party would 
try to break the protocol to measure their particles and 
to announce the outcome publicly? 

The answer of the question is as follows. Let X C N be 

a qualified set for a QSS scheme Wn- Then, Y = N\X 
is forbidden and there exists a decoding operation IZx 
for X recovering any pure state p from Wn(p)- 

(J Y <8> Kx)W N (p) = Wy(p) <8> p 

= Po®p, (34) 

where ly is the identity map and po = Wy (p) ■ Note that 
pure states have no entanglement with another systems 
and that po does not depend on p. Then, we can see that 
(34) also holds for mixed states p, and that any malicious 
operation Ey by the forbidden party Y could not interfere 
with the qualified set of shares, i.e., 

{ly ®TZ X ){£y ®l X )W N {p) 

= {Ey ® T x ){Ty <8> Kx)W N (p) 

= £y{p )®p. (35) 

However, the above arguments are not valid for inter- 
mediate sets of shares, i.e., a measurement on an inter- 
mediate set of shares may affect the quantum state of 
another intermediate set through the effects of the en- 
tanglement. For this reason, it is a challenging problem 
to classify intermediate sets in ramp QSS schemes. We 
need to study security conditions for ramp QSS schemes 
and to develop tools to quantify the information that an 
intermediate set of share has. These developments are 
left to further studies. 



APPENDIX: NO CLONING AND NO DELETING 
THEOREM 

In this paper, we have used a fundamental result in 
QSS schemes shown by Cleve et al. [3], that is, if a set 
of shares X C N is qualified, the complement N\X is 
necessarily forbidden, and, in addition, the converse is 
also true in pure state QSS schemes. These properties 
are regarded as variants of the no cloning theorem [11- 
15] and the no deleting theorem [51, 52]. Another proof of 
this property relevant to the no cloning theorem is given 
by an information theoretical manner in Ref. [43] . In this 



appendix, we will review these results in our notations 
for readers' convenience following the original proof [3] 
which utilizes the perfect error correcting condition [19] 
[20]. Here we introduce a notation £ ~ {E a } a by which 
we mean that £ is a quantum operation represented by 
the Kraus representation [53] £(p) = ^ a E a pE* a . 

Proposition 2 ([19, 20]). Let C : p e S{H) ^ VpV* e 
S(^T) be a quantum operation defined by an isometry 
V : H — > J , and let £ : S{J) — ► 5(/C) be a quantum 
operation represented by £ <~ {E a } a . Then the following 
conditions are equivalent. 

(a) £ ■ C is reversible w.r.t. S(H). 

(b ) For each pair of indices a and b, there exists C a b € 
C such that V*E* a E b V = C ab I H - 

Proposition 3 (Cleve-Gottesman-Lo [3]). Given a 
quantum operation Wxy ■ S(H) — > S(Hx <8> Wy), let 

W x = Try -W X y and Wy = f Tr x -Wxy- If W X y is 
a pure state channel and reversible, then the following 
conditions are equivalent. 

(a) Wx is reversible w.r.t. S(TL). 

(b) Wy is vanishing w.r.t. S(TL). 

In the case of general quantum operations, (a) implies 
(b). 

Proof. First, we show the equivalence when Wxy is a 
pure state channel and reversible. In this case, Wxy is 
written as Wxy(p) = VpV* by an isometry V : H — > 
Ttx ® Hy- Let {|a)} a be an orthonormal basis on Hy. 
Then it follows from Proposition 2 with £ = Try <~ { Ix <8> 
(a\} a that (a) holds iff there exists C a b € C such that 

V(a,6), V*(I X ® |a><6|)V = C ab I H - (A.l) 

Moreover, (A.l) is equivalent to the existence of a linear 
functional C : £(Hy) — > C such that 

g C(H Y ), V*(I x <8> A)V = C(A)I H . (A.2) 

Now we can easily see the equivalence of (A.2) and (b) 
from the following equalities: 

Tr[Wy(p)A] = Tt[W X y(p)(Ix ® A)] 

= Tr[pV*{I x ®A)V]. (A.3) 

In the general case, let Wxy(p) = Trz[UpU*] be 
the Stinespring representation [46], where U : H — > 
Hx^Hy ®H z is an isometry. Then W X yz(p) = UpU* 
is a pure state channel and reversible. From the above ar- 
gument, if Wx is reversible w.r.t. S(7i), then Wyz is van- 
ishing, and hence Wy is also vanishing w.r.t. S(H). □ 
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